CVE-2017-11610
Fixed in a distro release EPSS 88%
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
Products: supervisord supervisor, fedoraproject fedora, debian_linux, redhat cloudforms
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | supervisor | 3.0.1 |
| PyPI | supervisor | 3.1.4 |
| PyPI | supervisor | 3.2.4 |
| PyPI | supervisor | 3.3.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | supervisor | 3.2.4-r0 |
| Alpine 3.11 | supervisor | 3.2.4-r0 |
| Alpine 3.12 | supervisor | 3.2.4-r0 |
| Alpine 3.13 | supervisor | 3.2.4-r0 |
| Alpine 3.14 | supervisor | 3.2.4-r0 |
| Alpine 3.15 | supervisor | 3.2.4-r0 |
| Alpine 3.16 | supervisor | 3.2.4-r0 |
| Alpine 3.17 | supervisor | 3.2.4-r0 |
| Alpine 3.18 | supervisor | 3.2.4-r0 |
| Alpine 3.19 | supervisor | 3.2.4-r0 |
| Alpine 3.20 | supervisor | 3.2.4-r0 |
| Alpine 3.21 | supervisor | 3.2.4-r0 |
| Alpine 3.22 | supervisor | 3.2.4-r0 |
| Alpine 3.23 | supervisor | 3.2.4-r0 |
| Alpine 3.24 | supervisor | 3.2.4-r0 |
| Alpine 3.3 | supervisor | 3.1.4-r0 |
| Alpine 3.4 | supervisor | 3.2.4-r0 |
| Alpine 3.5 | supervisor | 3.2.4-r0 |
| Alpine 3.6 | supervisor | 3.2.4-r0 |
| Alpine 3.7 | supervisor | 3.2.4-r0 |
| Alpine 3.8 | supervisor | 3.2.4-r0 |
| Alpine 3.9 | supervisor | 3.2.4-r0 |
| Debian 12 | supervisor | 3.3.1-1.1 |
| Debian 13 | supervisor | 3.3.1-1.1 |
| Debian 14 | supervisor | 3.3.1-1.1 |
| Debian 7 | supervisor | 3.0a8-1.1+deb7u2 |
| Debian 8 | supervisor | 3.0r1-1+deb8u1 |
| Debian 9 | supervisor | 3.3.1-1+deb9u1 |
| Red Hat cloudforms managementengine 5.8 | ansible-tower-server | 0:3.1.5-1.el7at |
| Red Hat cloudforms managementengine 5.8 | ansible-tower-setup | 0:3.1.5-1.el7at |
| Red Hat cloudforms managementengine 5.8 | cfme | 0:5.8.2.3-1.el7cf |
| Red Hat cloudforms managementengine 5.8 | cfme-appliance | 0:5.8.2.3-1.el7cf |
| Red Hat cloudforms managementengine 5.8 | cfme-appliance-debuginfo | 0:5.8.2.3-1.el7cf |
| Red Hat cloudforms managementengine 5.8 | cfme-debuginfo | 0:5.8.2.3-1.el7cf |
| Red Hat cloudforms managementengine 5.8 | cfme-gemset | 0:5.8.2.3-1.el7cf |
| Red Hat cloudforms managementengine 5.8 | rabbitmq-server | 0:3.6.9-1.el7at |
| Red Hat cloudforms managementengine 5.8 | rh-ruby23-rubygem-nokogiri | 0:1.8.1-2.el7cf |
| Red Hat cloudforms managementengine 5.8 | rh-ruby23-rubygem-nokogiri-debuginfo | 0:1.8.1-2.el7cf |
| Red Hat cloudforms managementengine 5.8 | rh-ruby23-rubygem-nokogiri-doc | 0:1.8.1-2.el7cf |
| Red Hat cloudforms managementengine 5.8 | supervisor | 0:3.1.4-1.el7 |
| Ubuntu 14.04 LTS | supervisor | 3.0b2-1ubuntu0.1 |
| Ubuntu 16.04 LTS | supervisor | 3.2.0-2ubuntu0.2 |